Virus co-processor instructions and methods for using such

ABSTRACT

Circuits and methods for detecting, identifying and/or removing undesired content are provided. According to one embodiment, a method for virus processing is provided. A virus signature file that includes multiple virus signatures capable of detecting and identifying a variety of known viruses is downloaded by a general purpose processor. It is determined by the general purpose processor whether a virus co-processor is coupled to the general purpose processor. When the virus co-processor is determined to be coupled to the general purpose processor, then it is further determined by the general purpose processor which virus signatures are supported by the virus co-processor (“CP-supported virus signatures”). The CP-supported virus signatures are transferred to a memory associated with the virus co-processor. The virus co-processor is directed by the general purpose processor to perform a virus scan based on the supported virus signatures.

CROSS REFERENCE TO RELATED APPLICATIONS

This patent application is a continuation of U.S. patent applicationSer. No. 14/143,156, filed Dec. 30, 2013, which is a continuation ofU.S. patent application Ser. No. 13/567,183, filed Aug. 6, 2012, nowU.S. Pat. No. 8,646,083, which is a continuation of U.S. patentapplication Ser. No. 12/644,794, filed Dec. 22, 2009, now U.S. Pat. No.8,239,950, which is a continuation of U.S. patent application Ser. No.11/837,064, filed Aug. 10, 2007, now U.S. Pat. No. 8,079,084, all ofwhich are hereby incorporated by reference in their entirety for allpurposes.

The present application may relate to subject matter disclosed in one ormore of U.S. patent application Ser. No. 10/624,948; U.S. patentapplication Ser. No. 10/624,941; U.S. patent application Ser. No.10/624,452; and U.S. patent application Ser. No. 10/624,914. Each of theaforementioned applications is hereby incorporated by reference in itsentirety for all purposes.

COPYRIGHT NOTICE

Contained herein is material that is subject to copyright protection.The copyright owner has no objection to the facsimile reproduction ofthe patent disclosure by any person as it appears in the Patent andTrademark Office patent files or records, but otherwise reserves allrights to the copyright whatsoever. Copyright© 2007-2014, Fortinet, Inc.

BACKGROUND

1. Field

Embodiments of the present invention generally relate to circuits andmethods used for processing information, and more particularly tocircuits and methods for detecting, identifying and/or removingundesired content.

2. Description of the Related Art

The generation and spreading of computer viruses are major problems incomputer systems and computer networks. A computer virus is a programthat is capable of attaching to other programs or sets of computerinstructions, replicating itself, and performing unsolicited actions.Viruses may be embedded, for example, in email attachments, filesdownloaded from the Internet, and various application files. In somecases, such computer viruses may result in mild interference with systemperformance up to destruction of data and/or undermining of systemintegrity.

Various software products have been developed to detect and in somecases eliminate computer viruses from a system. Such software productsare installed by organizations on either individual computers or inrelation to computer networks. However, with the multitude of knownviruses and the almost weekly proliferation of new viruses, execution ofsoftware to check for viruses often has a noticeable negative impact onthe operation of the computers and computer systems that it is designedto protect. This negative impact may often become substantial, and insome cases more substantial than the impact posed by many potentialviruses.

SUMMARY

Circuits and methods for detecting, identifying and/or removingundesired content are described. According to one embodiment, a methodfor virus processing is provided. A virus signature file that includesmultiple virus signatures capable of detecting and identifying a varietyof known viruses is downloaded by a general purpose processor. It isdetermined by the general purpose processor whether a virus co-processoris coupled to the general purpose processor. When the virus co-processoris determined to be coupled to the general purpose processor, then it isfurther determined by the general purpose processor which virussignatures are supported by the virus co-processor (“CP-supported virussignatures”). The CP-supported virus signatures are transferred to amemory associated with the virus co-processor. The virus co-processor isdirected by the general purpose processor to perform a virus scan basedon the supported virus signatures.

This summary provides only a general outline of an embodiment of thepresent invention. Other features of embodiments of the presentinvention will become more fully apparent from the following detaileddescription, the appended claims and the accompanying drawings.

BRIEF DESCRIPTION OF THE DRAWINGS

A further understanding of the various embodiments of the presentinvention may be realized by reference to the figures which aredescribed in remaining portions of the specification. In the figures,like reference numerals are used throughout several drawings to refer tosimilar components. In some instances, a sub-label consisting of a lowercase letter is associated with a reference numeral to denote one ofmultiple similar components. When reference is made to a referencenumeral without specification to an existing sub-label, it is intendedto refer to all such multiple similar components.

FIG. 1 depicts a combined hardware and software virus processing systemin accordance with one or more embodiments of the present invention;

FIG. 2 is a flow diagram depicting a process for preparing bifurcatedhardware and software virus processing in accordance with variousembodiments of the present invention;

FIG. 3 shows a virus processing system in accordance with one or moreembodiments of the present invention;

FIG. 4 is a flow diagram showing a process of virus processing inaccordance with various embodiments of the present invention;

FIG. 5 depicts an exemplary virus signature that may be executed by avirus co-processor in accordance with some embodiments of the presentinvention;

FIG. 6 is a general architecture of a virus co-processor that may beutilized in accordance with different embodiments of the presentinvention;

FIG. 7 shows a virus co-processing system including dual execution pathsin accordance with some embodiments of the present;

FIG. 8A depicts an eight byte pre-fetch shift buffer that may be used inaccordance with different embodiments of the present invention toperform instruction alignment;

FIG. 8B shows an exemplary instruction alignment circuit that may beused in accordance with one or more embodiments of the presentinvention;

FIG. 8C depicts an exemplary execution unit that may be employed inrelation to one or more embodiments of the present invention;

FIG. 8D shows an exemplary data alignment circuit that may be used inaccordance with some embodiments of the present invention;

FIG. 9 is a flow diagram showing a method for using a dual pipeexecution system in accordance with different embodiments of the presentinvention; and

FIGS. 10A-10B depict an exemplary virtual addressing scheme that may beused in relation to different embodiments of the present invention.

DETAILED DESCRIPTION

Circuits and methods for detecting, identifying and/or removingundesired content are described.

Some embodiments of the present invention include computer readablemedia. The computer readable media may include a virus signaturecompiled for execution on a virus co-processor. As used herein, thephrase “computer readable media” is used in its broadest sense to meanany media that may be accessed by a computer. Thus, for example, acomputer readable medium maybe, but is not limited to, a semiconductormemory, a hard disk drive, a magnetic storage medium, an optical storagemedium, combinations of the aforementioned, and/or the like. Based onthe disclosure provided herein, one of ordinary skill in the art willrecognize a variety of computer readable media that may be used inrelation to different embodiments of the present invention.

The virus signature includes at least one primitive instruction and atleast one CPR instruction stored at contiguous locations in the computerreadable medium. The CPR instruction is one of an instruction set thatincludes, but is not limited to: a compare string instruction, comparebuffer instruction; perform checksum instruction; a seek instruction;and a test instruction. The primitive instruction may be, but is notlimited to, an add instruction, a branch instruction, a jumpinstruction, a load instruction, a move instruction, a logic ANDinstruction, a logic OR instruction, and/or a logic XOR instruction.

Other embodiments of the present invention provide virus processingsystems that include a virus co-processor and a general purposeprocessor. In addition, the systems further include a first memorycommunicably coupled to the virus co-processor via a first memoryinterface. The first memory includes a first virus signature compiledfor execution on the virus co-processor. The first virus signatureincludes at least one primitive instruction and at least one CPRinstruction stored at contiguous locations in the first memory. Thesystems further include a second memory communicably coupled to thevirus co-processor via a second memory interface and to the generalpurpose processor. The second memory includes a second virus signaturecompiled for execution on the general purpose processor. As used herein,the phrase “communicably coupled” is used in its broadest sense to meanany coupling whereby information may be passed from one element toanother element. Thus, for example, two devices may be communicablycoupled where a wire extends between the devices allowing for electronicsignals to pass between the devices. Alternatively, two devices may becommunicably coupled where an electronic output from one device or aderivative thereof is received by the other device. Based on thedisclosure provided herein, one of ordinary skill in the art willrecognize a variety of approaches for communicably coupling one elementto another. Also, as used herein, the term “memory” is used in itsbroadest sense to mean any electronic, magnetic, or optical media thatmay be used store information. Based on the disclosure provided herein,one of ordinary skill in the art will recognize a variety of memoriesand memory types that may be used in relation to different embodimentsof the present invention.

Turning to FIG. 1, a combined hardware and software virus processingsystem 100 is shown in accordance with one or more embodiments of thepresent invention. System 100 includes a general purpose processor 120and a virus co-processor 110. General purpose processor 120 executesvirus software 140 that is operating on a platform of an operatingsystem 130. Virus software 140 is capable of detecting, identifyingand/or cleaning or quarantining a number of different viruses. Virussoftware 140 may be written in any software language known in the art,and compiled using a compiler tailored for the particular softwarelanguage and target platform. Based on the disclosure provided herein,one of ordinary skill in the art will recognize a variety of softwarelanguages, compilers and/or operating systems that may be employed inrelation to different embodiments of the present invention.

Processing for some of the viruses is done purely in software. Suchsoftware processing involves general purpose processor 120 executingsoftware instructions tailored for virus processing and is identified assoftware processed viruses 150. Software processed viruses may includeone or more of a general set of virus signatures 180 that are compiledfor execution on general purpose processor 120. Processing for others ofthe viruses may be done using a combination of software processing andhardware processing. Such combination software and hardware processingincludes performing one or more virus processing functions on virusco-processor 110 and executing one or more instructions on generalpurpose processor 120. These viruses are identified as hardwareprocessed viruses 160. Such hardware processed viruses may include oneor more of the general set of virus signatures 180 that are compiled forexecution on virus co-processor 110. Thus, in some cases, virus software140 includes a compiled set of virus signatures that may be executed byvirus co-processor 110. This compiled set of virus signature may bewritten to a memory associated with virus co-processor 110 throughexecution by general purpose processor 120 of one or more instructionsincluded in virus software 140. It should be noted that the termssoftware and hardware are used somewhat loosely as virus co-processormay execute one or more local instructions, and general purposeprocessor is itself a hardware device. However, these words are usedherein to refer to processes performed by the general purpose processor120 at the direction of virus software 140 (i.e., software processing)and processes performed by virus co-processor 110 either purely inhardware or under the direction of software instructions (i.e., hardwareprocessing). Virus co-processor 110 may be implemented as asemiconductor device such as, for example, a programmable gate array oran application specific integrated circuit. Based on the disclosureprovided herein, one of ordinary skill in the art will recognize avariety of technologies that may be used to implement virus co-processor110.

In some embodiments of the present invention, two compilers areutilized. The first compiler is designed to compile virus signatures forexecution in software, and the second compiler is designed to compilevirus signatures for execution in hardware. In some cases, the samevirus signatures are compiled for both hardware and software execution.

General purpose processor 120 may be any processor that is tailored forexecuting software commands indicated by an operating system. Thus, forexample, general purpose processor may be, but is not limited to thevarious processors currently found in personal computers such as thoseoffered by Intel and AMD. In contrast, virus co-processor 110 istailored for performing one or more functions under the control of or atthe request of general purpose processor 120. Such functions include,but are not limited to, virus detection and/or virus identification of aparticular subset of viruses that may be processed by virus co-processor110. Other viruses that are not supported by virus co-processor 110 maybe processed by general purpose processor 120. In one particularembodiment of the present invention, general purpose processor 120 is agenerally available Intel processor and operating system 130 is one ofthe currently available Microsoft Windows operating systems. Based onthe disclosure provided herein, one of ordinary skill in the art willrecognize a variety of general purpose processors and/or operatingsystems that may be used in relation to different embodiments of thepresent invention.

In operation, virus co-processor 110 is programmed or otherwise enabledto detect and/or identify viruses included in hardware processed viruses160. This may be accomplished through execution of one or more setupinstructions included in virus software 140. The setup instructions maybe executed by general purpose processor 120 to cause the aforementionedcompiled set of virus signatures to be written to a memory accessible tovirus co-processor 110. This compiled set of virus signatures may thenbe executed locally by virus co-processor 110. Based on the disclosureprovided herein, one of ordinary skill in the art will recognize avariety of setup processes that may be performed in relation to one ormore embodiments of the present invention.

A data stream 170 is received by general purpose processor 120, and isreviewed to determine whether it has been infected by one or moreviruses. General purpose processor 170 makes the data in data stream 170available to virus co-processor 110. General purpose processor 120 maythen perform one or more virus scans by executing instructions inrelation to the data in data stream 170 looking to detect and/oridentify software processed viruses 150. Either in parallel or serially,virus co-processor 110 may perform one or more virus scans in relationto the data in data stream 170 looking to detect and/or identifyhardware processed viruses 160. When virus co-processor 110 finishesoperating on the data of data stream 170, it provides any results togeneral purpose processor 120. General purpose processor 120 may thenexecute instructions of virus software 140 that combines any resultsobtained in relation to software processed viruses 150 with the resultsof hardware processed viruses 160 obtained from virus co-processor. Asone of many advantages, use of virus-co-processor 110 may increase therate at which virus processing may be performed. Alternatively or inaddition, providing for both software and hardware processing of virusesmay increase the flexibility of system 100. As yet another alternativeor addition, providing hardware virus processing may offload operationalrequirements from general purpose processor 120 such that any impact ofvirus processing is reduced. Based on the disclosure provided herein,one of ordinary skill in the art will recognize a variety of otheradvantages that may be achieved in accordance with different embodimentsof the present invention.

Turning to FIG. 2, a flow diagram 200 depicts a process for preparingbifurcated hardware and software virus processing in accordance withvarious embodiments of the present invention. Following flow diagram200, a signature file is initially downloaded (block 205). Such asignature file includes a number of instructions capable of detectingand identifying a variety of known viruses and may be embodied in, forexample, virus software 140. The aforementioned download may include,but is not limited to, downloading virus software 140 to a memoryaccessible to general purpose processor 120. In such a case, virussoftware 140 may include instructions executable by general purposeprocessor 120 for detecting and/or identifying various viruses, andother instructions executable by virus co-processor 110 to detect and/oridentify the same viruses. In this way, virus software 140 may providefor detection and/or identification of a particular virus or set ofviruses through either software processing or hardware processing. Inone particular embodiment of the present invention, virus software 140is compiled in two versions—a software version and a hardware version.In some cases, two different compilers are used—one to compile thehardware version and another directed at the software version. Thecompiled hardware version is loaded into a memory associated with thevirus co-processor using a DMA transfer under the control of the generalpurpose processor, and the software version is loaded into memoryassociated with the general purpose processor.

It is determined whether hardware acceleration of virus processing issupported by the particular system to which the signature file isdownloaded (block 210). Such hardware support may be provided by, forexample, virus co-processor 110. Where hardware acceleration is notavailable (block 210), all virus detection is performed though executionof software instructions on a general purpose processor (block 240).Thus, for example, where the system executing virus software 140 doesnot include virus co-processor 110, all virus detection is performedthrough execution of virus software 140 on general purpose processor120.

Alternatively, where it is determined that hardware acceleration isavailable (block 210), it is determined which version of hardware isincluded (block 215). This may include, but is not limited to,determining a version of an integrated circuit in which a virusco-processor is implemented and/or determining a version of virussignatures that are currently available to a virus co-processor. Thismay be accomplished through execution of a software instruction on thegeneral purpose processor that issues a query to one or both of a virusco-processor and a memory associated with the virus co-processor. Basedon the aforementioned version determination (block 215), it isdetermined which virus signatures (i.e., which viruses that may beprocessed) that are currently supported by the hardware accelerator(block 220). This may include, for example, determining which virusesmay currently be detected by an associated virus co-processor. Thisprocess of determination may be performed by, for example, execution ofinstructions included in virus software 140 that compare version numbersagainst groups of known viruses.

It is next determined whether the hardware accelerator is to be updatedto include an expanded list of supported virus processing (block 225).Where the hardware accelerator is not to be updated (block 225), onlythe viruses currently supported by the hardware accelerator areprocessed in hardware while all other viruses are processed in software(block 240). In some cases, all viruses known to virus software 140 maybe supported by virus co-processor 110. In such a case, no viruses willbe processed directly by general purpose processor 120. In other cases,only some of the viruses known to virus software 140 are supported byvirus co-processor 110. In such a case, some viruses will be processedin hardware and others will be processed in software.

Alternatively, where the hardware accelerator is to be updated (block225), it is determined which of the virus signatures can be supported bythe particular version of the hardware accelerator (block 230). Where,for example, the hardware accelerator is virus co-processor 110, it isdetermined which of the virus signatures known to virus software 140could be processed using virus co-processor 110. In some cases, all ofthe viruses can be processed by virus co-processor 110, and in othercases, less than all of the viruses may be supportable. Virus signaturesfor the supportable viruses are then transferred to the hardwareaccelerator using a direct memory access initiated by the generalpurpose processor (block 235). This causes an increase in the number ofviruses that may be detected by the hardware accelerator. At this point,virus processing may be performed with the hardware acceleratorprocessing all of the viruses that it is capable of supporting, and thegeneral purpose processor performing software processing on all of theremaining viruses. In some cases, all viruses known to virus software140 may be supported by, for example, virus co-processor 110. In such acase, no viruses will be processed directly by general purpose processor120. In other cases, only some of the viruses known to virus software140 are supported by virus co-processor 110. In such a case, someviruses will be processed in hardware and others will be processed insoftware.

Turning to FIG. 3, a virus processing system 300 in accordance with oneor more embodiments of the present invention is depicted. Virusprocessing system includes a virus processing hardware acceleratorembodied as virus co-processor 310, and a general purpose processor 320.General purpose processor 320 may be any processor that is tailored forexecuting software commands indicated by an operating system. Thus, forexample, general purpose processor may be, but is not limited to thevarious processors currently found in personal computers such as thoseoffered by Intel and AMD. In contrast, virus co-processor 310 istailored for performing one or more functions under the control of or atthe request of general purpose processor 320. Such functions include,but are not limited to, virus detection and/or virus identification of aparticular subset of viruses that may be processed by virus co-processor310. Other viruses that are not supported by virus co-processor 310 maybe processed by general purpose processor 320. In one particularembodiment of the present invention, general purpose processor 320 is agenerally available Intel processor. Based on the disclosure providedherein, one of ordinary skill in the art will recognize a variety ofgeneral purpose processors that may be used in relation to differentembodiments of the present invention. Virus co-processor 310 may beimplemented as a semiconductor device such as, for example, aprogrammable gate array or an application specific integrated circuit.Based on the disclosure provided herein, one of ordinary skill in theart will recognize a variety of technologies that may be used toimplement virus co-processor 310.

Virus co-processor 310 is associated with a local virus signature memory315. Virus signature memory 315 may be integrated onto an integratedcircuit implementing virus co-processor 310. Alternatively, or inaddition, virus signature memory 315 may be implemented using anoff-chip memory. Such a memory may be, but is not limited to, a flashmemory, a cache memory, a random access memory, a read only memory, anoptical memory, a hard disk drive, combinations of the aforementioned,and/or the like. Based on the disclosure provided herein, one ofordinary skill in the art will recognize of variety of memory types thatmay be utilized in relation to different embodiments of the presentinvention.

A bus/memory interface 325 provides control for an interconnect bus 340and access to a system memory 330. In particular embodiments of thepresent invention, interconnect bus 340 is a PCI bus, memory 330 is arandom access memory 330, and bus/memory interface 325 is a chipsetcurrently available for controlling the PCI bus and providing access tosystem memory 330. It should be noted that interconnect bus 340 may be,but is not limited to, a PCI interface, a PCIX interface, a PCIeinterface, or an HT interface.

System memory 330 may be, but is not limited to, a flash memory, a cachememory, a random access memory, an optical memory, a hard disk drive,combinations of the aforementioned, and/or the like. System memory 330includes, but is not limited to, a task control 362, a page table 352and content 364. Content 364 includes one or more content objects 374that are identified in task control 362. As shown, only a single contentobject is included, but it should be noted that two or more contentobjects may be maintained simultaneously in system memory 330. As usedherein, the phrase “content object” is used in its broadest sense tomean and set of information. Thus, for example, a content object may bean email message, a word processing document, a video stream, an audiostream, combinations of the aforementioned, and/or the like. Page table352 include page information used by general purpose processor 320 andvirus co-processor 310 to perform virtual address access to/from systemmemory 330. Task control 362 includes a file type indicator 364 for eachof the content objects in content 364. Thus, where a content object is aword processing file, the associated file type included in task control362 would indicate that the content object is a word processing file. Inaddition, task control 362 includes pointers 368 to each of theassociated content objects included in content 364. Further, taskcontrol 362 includes a return result location that may be used by virusco-processor 310 to write any virus scan results. The file typeindicator may be used to select a certain subset of virus signaturesthat will be executed against the particular file. For example, theremay be a number of virus signatures that are relevant to a wordprocessing file, and others that are not relevant to word processingfiles. In such a case where an incoming file is a word processing file,only the signatures relevant to a word processing file type are executedagainst the file. This approach reduces the processing power that mustbe applied to a given file, while at the same time providing areasonably thorough virus scan. It should be noted that the phrase “filetype” is used in its broadest sense to mean a class into which a filemay be assigned. Thus, a file type may indicate a type of file, a stringtype, a macro type or the like. In some cases, a file may be identifiedas being associated with two or more file types. As some examples, afile type may be, but is not limited to, a proprietary file type such asa particular word processing document type, an executable file, a macrofile, a text file, a string. Based on the disclosure provided herein,one of ordinary skill in the art will recognize a variety of file typesthat may be identified in accordance with different embodiments of thepresent invention.

Virus processing system 300 further includes an I/O device 335. I/Odevice 335 may be any device capable of receiving information for andproviding information from virus processing system 300. Thus, I/O device335 may be, but is not limited to a USB communication device or anEthernet communication device. In some cases, I/O device 335 may beintegrated with either general purpose processor 320 or virusco-processor 310. Based on the disclosure provided herein, one ofordinary skill in the art will recognize a myriad of I/O devices thatmay be used in relation to virus processing system 300.

General purpose processor 320 is communicably coupled to virusco-processor 310 and I/O device 335 via interconnect bus 340. Bus/memoryinterface 325 provides access to/from system memory to each of generalpurpose processor 320, virus co-processor 310 and I/O device 335. Itshould be noted that the architecture of virus processing system 300 isexemplary and that one of ordinary skill in the art will recognize avariety of architectures that may be employed to perform virusprocessing in accordance with various embodiments of the presentinvention.

In operation, virus co-processor 310 is programmed or otherwise enabledto detect and/or identify viruses. Such programming includestransferring compiled virus signatures from system memory 330 to virussignature memory 315 using a direct memory transfer under the control ofgeneral purpose processor 320. These virus signatures may then beexecuted locally by virus co-processor 310. Based on the disclosureprovided herein, one of ordinary skill in the art will recognize avariety of mechanisms that may be used to store virus signatures tovirus signature memory in relation to one or more embodiments of thepresent invention.

A data stream 390 is received via I/O device 335. A content objectincorporated in the data stream is stored to system memory 330 ascontent 364. This storage may be accomplished directly by I/O device 335or indirectly under the control of general purpose processor 320.General purpose processor 320 accesses the received data and determineswhat type of file the data is associated with. Upon making itsdetermination, general purpose processor 320 records the file type intask control 362, file type 364; and records a pointer to the locationin system memory 330 where the content object is stored. This process ofidentifying the file type and content object pointer is generallyreferred to herein as virus pre-processing.

At this point, general purpose processor 320 may actively indicate tovirus co-processor 310 that a content object is available forprocessing. Such active indication may be accomplished by, for example,asserting an interrupt. As another example, such active indication mayinclude general purpose processor 320 writing a value or flag to virusco-processor 310 that cause virus co-processor 310 to start processing.Alternatively, general purpose processor 320 may passively indicate tovirus co-processor 310 that a content object is available forprocessing. Such passive indication may be accomplished by, for example,setting a flag as part of task control 362. The aforementioned flagsetting may include writing a task queue pointer to indicate that a newtask is ready for processing. Virus co-processor 310 is then responsiblefor polling the flag to determine the availability of a content objectfor processing. Based on the disclosure provided herein, one of ordinaryskill in the art will recognize a variety of mechanisms that may be usedto alert virus co-processor 310 of a content object that is ready forprocessing.

Virus co-processor 310 accesses task control 362 and pulls both filetype 364 and content object pointer 368 associated with the contentobject that is to be processed. Virus co-processor 310 uses file type364 to determine which virus signatures included in virus signaturememory 315 that are relevant to the particular file type. Thus, forexample, where the file type indicates that content object 374 is a wordprocessing document, only virus signatures associated with viruses knownto attach to word processing documents are considered. Thus, by usingfile type 364, the number of virus signatures that will be executed byvirus co-processor 310 may be substantially reduced without anysignificant impact on the accuracy of the performed virus processing.Such a reduction in the number of virus signatures can result in asubstantial savings in the amount of processing that must be performed.

Virus co-processor 310 uses the retrieved content object pointer 368 toaccess content object 374 from system memory 330. In turn, virusco-processor executes the virus signatures from virus signature memory315 that are relevant to file type 364. This may include executing anumber of pattern comparisons to determine whether one or more viruseshave attached to content object 374. Once all of the relevant virussignatures have been executed against content object 374, a result iswritten by virus co-processor 310 to task control 362 at the resultlocation (i.e., return result 366). Such a result may indicate thatcontent object 374 is free of any viruses where all virus signaturespassed, or may indicate one or more viruses attached to content object374 corresponding to failures of virus signatures executed againstcontent object 374. In particular, where all of the signatures areexecuted against the file and no matches are indicated, a result isreturned indicating that the file is clean (i.e., not infected by anyvirus known to virus co-processor 310). Alternatively, a match indicatesthat the file may be infected by a virus corresponding to the signaturethat generated the match. In such a case, the returned result indicatesthe one or more possible infections. Based on the disclosure providedherein, one of ordinary skill in the art will recognize a variety ofresulting encodings that may be written to task control 362 to indicatevarious status being returned by virus co-processor 310 that may be usedin relation to various embodiments of the present invention.

At this point, virus co-processor 310 may actively indicate to generalpurpose processor 320 that results of a virus scan are available. Again,such active indication may be accomplished by, for example, asserting aninterrupt. Alternatively, virus co-processor 310 may passively indicateto general purpose processor 320 that virus processing results areavailable. Again, such passive indication may be accomplished by, forexample, setting a flag as part of task control 362. General purposeprocessor 320 is then responsible for polling the flag to determine theavailability of results. Based on the disclosure provided herein, one ofordinary skill in the art will recognize a variety of mechanisms thatmay be used to alert general purpose processor 320 of an availableresult. General purpose processor 320 may use the result to effectivelyaddress the virus threat if any. For example, general purpose processor320 may clean an identified virus or it may quarantine or delete theinfected content object. Based on the disclosure provided herein, one ofordinary skill in the art will recognize a variety of operations thatmay be performed in relation to a content object identified as infected.

Turning to FIG. 4, a flow diagram 400 shows a process of virusprocessing in accordance with various embodiments of the presentinvention. Of note, the processes of flow diagram 400 are shown in twocolumns—a left column 410 indicating operations performed by a generalpurpose processor, and a right column 420 indicating operationsperformed by a virus co-processor. It should be noted that theoperational differentiation between the general purpose processor andthe virus co-processor may be modified in different embodiments of thepresent invention.

Following flow diagram 400, a general purpose processor receives acontent object and determines what type of file the content objectrepresents (block 425). The general purpose processor then sets upvarious virus scan parameters (block 430). The virus scan parameters arethen passed to a system memory accessible to a virus co-processor (block435). This may include, for example, writing a pointer to the contentobject and the file type of the content object to a task controllocation in the system memory.

The virus scan parameters are then accessed from the system memory bythe virus co-processor (block 440). This may include, for example,reading a content object pointer and a file type message from the systemmemory. The virus signatures accessible to the virus co-processor arethen parsed to select only the virus signatures that are relevant to thefile type indicated in the file type message read from the system memory(block 445). The content object pointed by the content object pointerread from the system memory is then compared with known viruses byexecuting the identified virus signatures (block 450). The results ofexecuting the virus signatures are then written to the system memory(block 455). The general purpose processor then pulls the results fromthe system memory (block 460), and utilizes the results (block 465). Thegeneral purpose processor may use the result to effectively address thevirus threat if any. For example, the general purpose processor mayclean an identified virus or it may quarantine or delete the infectedcontent object. Based on the disclosure provided herein, one of ordinaryskill in the art will recognize a variety of operations that may beperformed in relation to a content object identified as infected.

Turning to FIG. 5, an exemplary virus signature 500 is shown that may beexecuted by a virus co-processor in accordance with some embodiments ofthe present invention. A shown, exemplary virus signature 500 includes anumber of op-codes 510 that may each be associated with a particularstring or set of parameters 550. In particular, exemplary virussignature 500 includes a first instruction including a Content PatternRecognition (“CPR”) op-code 515 and a string 555; a second instructionincluding a primitive op-code 520 and a parameter(s) 560; a thirdinstruction including a CPR op-code 525 and a string 565; a fourthinstruction including a CPR op-code 530 and a string 570; a fifthinstruction including a primitive op-code 535 and a parameter(s) 575;and a sixth instruction including a primitive op-code 540 and aparameter(s) 580. Exemplary virus signature would be created to performa number of functions that together identify a particular virus patternin association with a content object. Thus, for example, the strings maybe patterns that are known to exist when a particular pattern ispresent. The op-codes may, for example, cause the individual strings tobe compared against a content object in a particular order such that thepresence or absence of a given virus may be confirmed in relation to aparticular content object. It should be noted that exemplary virussignature represents a number of possible virus signatures that may bedeveloped and utilized in relation to different embodiments of thepresent invention. Such virus signatures may include as few as oneinstruction or as many as thousands of instructions depending upon theparticular implementation and the virus that the particular virussignature is intended to detect.

The aforementioned CPR op-codes are generally referred to as complexinstructions, and the primitive op-codes are generally referred to assimple instructions. In some embodiments of the present invention, thecomplex instructions and the simple instructions are executed usingseparate processing pipes. This architecture is more fully describedbelow in relation to FIG. 7.

One example of a CPR instruction set is described in U.S. patentapplication Ser. No. 10/624,452, entitled “Content Pattern RecognitionLanguage Processor and Methods of Using the Same” that was filed on Jul.21, 2003 by Wells et al. The entirety of the aforementioned patentapplication is incorporated herein by reference for all purposes.Another example of a CPR instruction set is included in Table 1 belowwhich shows hardware encoding, and an example of a primitive instructionset forth in Table 2.

TABLE 1 Virus Co-Processor Supported CPR Op-Codes CPR Op-Code Byte codeLength (byte) Description !(predicate DD 1 This predicate exists only asa prefix for another (arguments)) predicate. It reverses the true orfalse return (flag) of the previous predicate when EOBF and SEF arezero. A(“string”) 00 len string >=3 compare text string, it matches astring that starts at the current location. A(byte range, 01 lenrange >=4 It searches from the current buffer pointer location for“string”) string the first occurrence of the string literal within rangeA(long start 02 len >=11 It searches from the provided start offset forthe first offset, long longoffset occurrence of the string literalwithin range range, string) longrange string A(ALL, 03 len string >=3 Itsearches the entire buffer from the start looking for “string”) thefirst occurrence of the string literal. A(long range, 04 len >=7 Itsearches from the current buffer pointer location for “string”)longrange string the first occurrence of the string literal within rangebitmask 0A mask byte 3 simply applies the mask to the next byte in thebuffer B(mask, byte) and compares it to byte case 14 len B1, L1, 4, 6, 8. . . comparing the next byte in the buffer with a series of C(B1, L1,B2, B2, L2, . . . , bytes. Each byte in the series is followed by alabel L2 . . . , Bn, Ln) Bn, Ln byte. If any byte matches, the signaturepointer moves (L is two bytes) to the related label in the sig., If noneof the bytes in the series match then the signature fails checksum 19NUM 7 calculates the checksum of next <number of bytes> in CKM(<numberCHKSUM the buffer, and compare to <checksum value>. Return of bytes>,(NUM is two true if the values match and false otherwise. <checksumbytes unsigned) It fails if there are less than <number of bytes> leftin value>) (CHKSUM is the buffer four bytes) Goto 3C shortoffset 3 movethe signature pointer to a new location specified G(Ln) by label whichis an unsigned short (2 bytes) as the forward reference Return true 3D 1It terminates and returns true G(true) Return false 3E 1 It terminatesand returns false if previous predicate G(false) return false H(heuristic Subroutine Tests heuristic flags with the four byte flagwhich is a flag) integer bitmask (logic and) I(test, label) 50 test L1 4comparing the next byte in the buffer with a argument byte. If the bytesmatch then the signature pointer is moved to the label location andprocessing continues I(Predicate, 51 Predicate 51 >=5 If the predicatematch then the signature pointer is label) label moved to the labellocation and processing continues, otherwise SP continue. Jump 58 1moving Buffer Pointer to a relative location before or J(byte) after thecurrent buffer position by the byte in buffer J(word) 59 1 moving BufferPointer to a relative location before or after the current bufferposition by the word in buffer J(dword) Subroutine moving Buffer Pointerto a relative location before or after the current buffer position bythe Dword in buffer J(IF_LAST) Subroutine Dword is read from buffer andcompared to the virtual ranges of the different sections of a PE file.If it lands in the last section then it will be followed, otherwise thejump predicate will fall through to the next predicate in the signatureJ(ABS, Subroutine The predicate is used for some viruses thatprecalculate <jump_type>) the jump offset. Instead of using the nextbuffer data as address for calculating the offset the offset is useddirectly. Literal 6E len stream >=3 It tests the buffer stream startingat the current location L(stream) with the literal byte stream, thefirst argument is the number of bytes in the stream L(byte range, 6F lenrange >=4 It tests the buffer stream starting at the current locationstream) stream within range with the literal byte stream, the firstargument is the an unsigned byte value show the range L(long start 70len start_off >=11 It searches from the provided long start offset forthe offset, long range stream first occurrence of the byte stream withinlong range range, stream) L(ALL, 71 len stream >=3 It tests all bufferwith the literal byte stream, the first stream) argument is the numberof bytes in the stream L(long range, 72 len >=9 It tests the bufferstream starting at the current location stream) long_range within rangewith the literal byte stream, the first stream argument is the anunsigned byte value show the range LOC 77 7 compare the current bufferpointer to a reference (Operator, reference_location location in thefile offset, Operator offset Operator: unsigned byte <reference Bytes:signed long which is offset of ref location location>) referencelocation: unsigned byte Rewind B0 2 Reset the buffer pointer an unsignedoffset within, and (Reset) unsigned_offset in relation to, the sectionof the buffer that starts at the R(byte) signature start positionR(+/−byte) B1 2 moves the buffer pointer a signed distance from thesigned_offset current buffer pointer location. That is it adds a signedvalue to the pointer Seek B4 5 moves the buffer pointer a signed longoffset within the S(n, long_offset buffer from beginning of buffer.(relative) SEEK_SET) Seek B5 5 moves the buffer pointer a signed longoffset within the S(n, long_offset buffer from end of file. (relative)SEEK_END) Seek B6 5 moves the buffer pointer a signed long offset withinthe S(n, long_offset buffer from current location (relative) SEEK_CUR)SZ (operator, B9 operator 6 or 10 compare the size of the file (buffer)to a specified value filesize) or filesize with different operation filesize, lower file size, upper SZ (RG, Or file size (unsigned long) <lowerfile B9 RG size>, <upper lower_filesize file size>) upper_filesize TestBE byte byte 3 tests the next two bytes in buffer If both bytes areT(AND) present in any order, then a match is returned Test BF byte byte3 tests the next two bytes in buffer If one and only one T(XOR) bytes ispresent, then a match is returned Test C0 len byte 4, 5, 6, . . . testsa list of 2 or more bytes against the next single T(OR) byte . . . bytein the buffer. If the next buffer byte matches any bytes in the list amatch is returned Test C1 len byte . . . 3, 4, 5, 6, . . . tests a listof 1 or more bytes against the next single T(NOT) byte in the buffer. Ifthe next buffer byte matches any bytes in the list, return falseUppercase CD len string >=3 Like the A(“string”) predicate, just notcase-sensitivity. U(“string”) The compiler should uppercase all thestring inside U U(byte range, CE len range >=4 predicate. Hardware willconvert all char to uppercase “string”) string in the data buffer tocompare with. U(long start CF len >=11 offset, long longoffset range,string) longrange string U(ALL, D0 len string >=3 “string”) U(longrange, D1 len >=7 “string”) longrange string Variable D2 len >=5 Countsmatches for one or more test bytes within a V(EQ, range, benchmarkspecified range, then compare with the benchmark, if benchmark, rangetest_bytes EQ(equal), return TRUE byte_list) Variable D3 len >=5 Countsmatches for one or more test bytes within a V(GT, range, benchmarkspecified range, then compare with the benchmark, if benchmark, rangetest_bytes GT(greater than), return TRUE byte_list) Variable D4 len >=5Counts matches for one or more test bytes within a V(LT, range,benchmark specified range, then compare with the benchmark, ifbenchmark, range test_bytes LT(less than), return TRUE byte_list)Wildcard D8 1 simply skip(moves) the buffer pointer ahead 1 byte W(1)W(2) D9 1 simply skip(moves) the buffer pointer ahead 2 bytes W(n) DA n2 simply skip(moves) the buffer pointer ahead n bytes W(n, byte) DC nmbyte 3 check each byte for the next n bytes for a byte matching“mbyte”. If no byte is found in range return false. Else return true andleave buffer pointer pointing to the byte after the matching byte.Z(long) DE length 5 The long value following the predicate identifier iscompared to the “inset” value received from the calling program. If thetwo values are equal then continue with the signature, else returnfalse.

TABLE 2 Virus Co-Processor Primitive Op-Codes Primitive Length Op-CodeParameter(s) (byte) Function ADD R1, R2, R3 4 signed add two register'scontents and load result to a register ADDI R1, R2 4 signed addimmediate value and one register's content and load result to a registerAND R1, R2, R3 4 AND two register's contents and load result to aregister ANDI R1, R2 4 AND immediate value and one register's contentsand load result to a register BIF Flag 4 branch if flag set BINF Flag 4branch if no flag set JR R1 4 Jump to address in register JAL 4 Jump toimmediate address and link original SP to GPR15 JALR R1, R2 4 Jump toaddress in register and link original SP to general register LDBS R1, R24 load data byte from memory which addressed by another register andsign extension LDBZ R1, R2 4 load data byte from memory which addressedby another register and zero extension LDWS R1, R2 4 load data word frommemory which addressed by another register and sign extension LDWZ R1,R2 4 load data word from memory which addressed by another register andzero extension LDL R1, R2 4 load data long from memory which addressedby another register MFSPR R1 4 move data from SPR to general registerMTSPR R1 4 move data to SPR from general register MOVHI R1 4 loadimmediate data to Hi word of general register NOP 1 Non operations ORR1, R2, R3 4 OR two register's contents and load result to a registerORI R1, R2 4 OR immediate value and one register's contents and loadresult to a register SFEQ R1, R2 4 Set Flag if equal with two generalregisters' contents SFNE R1, R2 4 Set Flag if not equal with two generalregisters' contents SFGES Flag, R1, R2 4 Set Flag if Great than or equalsigned SFGTS Flag, R1, R2 4 Set Flag if Great than signed SFGEU Flag,R1, R2 4 Set Flag if Great than or equal unsigned SFGTU Flag, R1, R2 4Set Flag if Great than unsigned SUB R1, R2, R3 4 subtract two register'scontents and load result to a register SDL R1 4 store data long tomemory which addressed by another register XOR R1, R2, R3 4 XOR twocontents and load result to a register

In embodiments of the present invention where separate hardware andsoftware compilers are used, the hardware compiler may be tailored toprepare instructions for execution by the virus co-processor. In such acase, the hardware compiler may treat each virus signature whichincludes both CPR op-codes and primitive op-codes such that the compiledinstructions intermingles the primitive and CPR op-codes. The fetch unitof the virus co-processor can be designed such that it is capable ofdealing with intermixed CPR and primitive op-codes. In some cases, wherethe hardware compiler detects that a primitive op-code follows a CPRop-code, the compiler may add NOP instructions to enforce long-wordalignment. In addition, the hardware compiler may add a termination codeat the end of each virus signature to cause the virus co-processor toset the proper termination flags and to properly store results of theexecuted virus signature. Based on the disclosure provided herein, oneof ordinary skill in the art will recognize a variety of compilertechniques that may be used in compiling virus signatures for executionby the virus co-processor.

Turning to FIG. 6, a general architecture of a virus co-processor 600that may be utilized in accordance with different embodiments of thepresent invention. Virus co-processor 600 is a dedicated hardwaremicrostructure that is designed to increase the throughput of virusprocessing when compared with performing virus processing on a generalpurpose processor alone. Virus co-processor 600 includes a co-processorcore 650 that has a four level instruction pipeline including a fetchmodule 660, a decode module 665, an execution memory module 670 and awrite back module 675. In addition, co-processor core 650 includes acontrol registers block 655 and a register file 680.

Virus co-processor 600 further incorporates an interface that includes acache bus controller 625 that provides for memory accesses via a virussignature cache 605 and a data buffer cache 620. Further, cache buscontroller 625 provides for access to an external memory such as a virussignature memory via a memory controller 610. In addition, the interfaceincludes a PCI interface 615.

In this particular embodiment of the present invention, virusco-processor 600 differs from a typical general purpose processor, amongother things, a separate instruction and data cache and use of aSignature Pointer (SP) for instructions and another Buffer Pointer (BP)for data. In some cases, instructions (i.e., virus signatures) areaccessed from a local virus signature memory via a dedicated memory bus(i.e., via memory controller 610) and data is accessed via the PCI bus(i.e., via PCI interface 615). Further, instructions of variable lengthare accessed together using a common fetch module (i.e., fetch module660). Thus, it operates like a combination CISC and RISC processor wherethe CISC instructions are represented by CPR instructions and the RISCinstructions are represented by primitive instructions. Subroutines(i.e., virus signatures) are executed in serial with a result returnedat the end. Memory write back is limited to the conclusion of a virussignature. Based on the disclosure provided herein, one of ordinaryskill in the art will recognize a variety of other differences betweenthe different embodiments of virus co-processors discussed herein andtypical general purpose processors. Further, one of ordinary skill inthe art will recognize that not all of the aforementioned differencesare necessarily incorporated into each embodiment of a virusco-processor according to the different embodiments of the presentinvention.

Turning to FIG. 7, a virus co-processing system 700 including dualexecution paths in accordance with different embodiments of the presentinvention is shown. Virus co-processing system includes a virusco-processor 710 and a virus signature memory 790. Virus signaturememory 790 includes a number of virus signatures that include acombination of intermixed CPR op-codes and primitive op-codes. Theseintermixed op-codes are designed for serial operation to detect aparticular virus that may have attached to a particular content object.

Virus co-processor 710 includes a unified fetch and parse module 715that retrieves instructions from virus signature memory 790, parses theretrieved instructions, and feeds instructions to respective instructionpipes 720, 740. In particular, where a retrieved instruction is aprimitive instruction, it is fed to primitive instruction pipe 720 forexecution, and where a retrieved instruction is a CPR instruction it isfed to CPR instruction pipe 740 for execution. Primitive instructionpipe 720 is a three stage pipe including a decode unit 725, an executeunit 730 and a write back unit 735. CPR instruction pipe 740 is a threestage pipe including a decode unit 745, an execute unit 750 and a writeback unit 755. A merge result module 760 may be included toappropriately combine the results from each of primitive instructionpipe 720 and CPR instruction pipe 740. In some cases, merger resultmodule 760 may be eliminated where interlocks between primitiveinstruction pipe 720 and CPR instruction pipe 740 assure a completelyserial execution of primitive and CPR op-codes. By interlocking thepipes the write back for each of the pipes should effectively performthe merge function. In such a case, write back units 735, 755 write theresult from an executed instruction to memory in a particular order thateffectively performs the function that would be performed by thenon-existent merge result module 760.

In one particular embodiment of the present invention, unified fetch andparse module 715 is responsible for fetching instructions from theinstruction cache where it is available in the cache, or from virussignature memory where it is not available in the cache. Unified fetchand parse module 715 may retrieve instructions from any byte boundary,and deliver the retrieved instructions to the respective instructionpipes aligned on instruction boundaries. In some cases, such a fetchmodule is capable of retrieving and aligning instructions that varybetween one and two hundred, fifty-six bytes in length including theop-code and immediate data.

In some embodiments of the present invention, unified fetch and parsemodule 715 includes an instruction alignment module that worksconsistent with that discussed in relation to FIG. 8A. Turning to FIG.8A, an eight byte pre-fetch shift buffer 800 is used to performinstruction alignment prior to sending instructions to the decode unitsof the respective instruction pipes 720, 740. As shown, a word boundary810 precedes byte 0, another word boundary precedes byte 4, and yetanother word boundary succeeds byte 7. Of note, an exemplary instructionboundary 840 does not align with any of word boundaries 810, 820, 830.

In operation, eight contiguous word aligned bytes are pulled from virussignature memory 790 (or from an associated cache where the bytes havebeen previously cached). The eight bytes are loaded into pre-fetch shiftbuffer 800. Unified fetch and parse module 715 queries the retrievedbyte to identify any possible op-code. That op-code is then sent to theappropriate instruction pipe along with an expected amount of immediatedata associated with the op-code. In sending the op-code, unified fetchand parse module 715 aligns the op-code and immediate data for executionby the selected instruction pipe.

Alternatively, unified fetch and parse module 715 may be ignorant to theinclusion of an op-code in pre-fetch shift buffer 800 or any alignmentconcerns. In such a case, the entire pre-fetch shift buffer 800 may bemade available to the decoder in each of instruction pipes 720, 740. Insuch a case, each of the instruction pipes determines whether pre-fetchshift buffer 800 includes an instruction that they are to execute. Inthis case, the respective decode unit instructs pre-fetch shift buffer800 about the size of each decoded instruction by asserting one or moreinterface signals indicating the number of bytes that are associatedwith the identified op-code. Unified fetch and parse module 715continues pulling information from virus signature memory 790 intopre-fetch shift buffer 800 and the decode unit continually accesses theretrieved information until it has sufficient information to beginexecution of the identified op-code.

FIG. 8B shows an exemplary alignment circuit 890 that may be used inaccordance with one or more embodiments of the present invention. Asshown, alignment circuit 890 includes an instruction cache 892 that iscapable of providing four bytes of data in parallel. This information isaligned into eight registers 870, 871, 872, 873, 874, 875, 876, 877using multiplexers 880, 881, 882, 883, 884, 885, 886, 887. Thus, once aninstruction boundary is identified, control can be applied tomultiplexers 880, 881, 882, 883, 884, 885, 886, 887 such that subsequentaccesses to instruction cache 892 are aligned to instruction boundaries.Based on the disclosure provided herein, one of ordinary skill in theart will recognize a variety of other circuits that may be utilized toprovide data alignment in accordance with some embodiments of thepresent invention.

Referring back to FIG. 7, decode unit 725 is responsible for decodingprimitive instructions, and decode unit 745 is responsible for decodingCPR instructions. Together, decode units 725, 745 are responsible forcontrolling the sequencing of intermixed CPR instructions and primitiveinstructions. In particular, when a multi-cycle CPR instruction isencountered by CPR instruction pipe 740, primitive instruction pipe 720may be stalled to assure that the intermixed CPR instructions andprimitive instructions proceed in order. Decode unit 745 breaks downmulti-cycle CPR instructions into their micro-operations and transferthe microinstruction to execution unit 750. In addition, decode unit 745calculates any branch or jumps based on various flags and/or op-codes.Decode units 725, 745 provide executable instructions to execution units730, 750.

Execution units 730, 750 are responsible for performing actual datacomputations indicated by the particular op-codes. Execution units 730,750 include a main computation ALU and shifter along with memoryoperation circuitry. FIG. 8C depicts an exemplary execution unit 857that may be employed in relation to one or more embodiments of thepresent invention. Any memory data access may be based on a bufferedaddress computed in the previously described decode units 725, 745. Thedata cache outputs the data to the execution unit. Most of the CPRinstructions and primitive instructions involve comparison and logicoperations, thus some embodiments of the present invention employexecution units that do not include a multiplier/divider circuit. Asshown, exemplary execution unit 857 further includes temporary storageregisters.

FIG. 8D shows an exemplary data fetch circuit 1100 is depicted. Datafetch circuit 1100 includes an upper bank 1110 and a lower bank 1120. Anaddress is applied to upper bank 1110 via an upper address multiplexer1130, and an address is applied to lower bank 1120 via a lower addressmultiplexer 1140. Upper bank 1110 contains data with odd DWORDaddresses, and lower bank 1120 contains data with even DWORD addresses.Application of the appropriate address causes two long words (sixty-fourbits) of data to be provided at the inputs of a data multiplexer 1150.The lower order bits of the applied address are registered using anaddress register 1160. The output of address register 1160 selects whichbytes of the two long words that are used to drive a four byte dataoutput 1170. In this way, alignment of otherwise misaligned data maybeachieved. In particular, where two long words of data are alwaysretrieved, four bytes of data can be accessed and selected. This allowsfor a situation where the general purpose processor is not necessarilyrequired to enforce long word alignment for data that is to be virusscanned. Based on the disclosure provided herein, on of ordinary skillin the art will recognize other approaches and/or circuits that may beused to perform data alignment in accordance with different embodimentsof the present invention.

Turning to FIG. 9, a flow diagram 900 shows a method for using a dualpipe execution system in accordance with different embodiments of thepresent invention. Following flow diagram 900, a file type is receivedthat identifies the type of a content object that is to be virusprocessed, and based on the file type a subset of virus signaturesapplicable to the file type are chosen for processing (block 905). Thus,for example, there may be hundreds of virus signatures included in avirus signature memory, but only ten of the virus signatures areapplicable to the identified file type. In this case, only the tenrelevant virus signatures would be executed against the particularcontent object. Once the subset of signatures that are to be executedare identified (block 905), the first of the identified virus signaturesis accessed from the virus signature memory (block 910). The firstop-code and associated immediate data are accessed from the virussignature (block 915), and it is determined whether the op-code is a CPRinstruction or a primitive instruction (block 920).

Where the instruction is a primitive instruction (block 920), theoperation is sent to the primitive pipe for execution (block 925).Alternatively, where the instruction is not a primitive instruction(block 920), the instruction is sent to the CPR pipe for execution(block 955). Where the instruction is sent to the primitive pipe forexecution (block 925), it is decoded (block 930). It is also determinedif execution of the received instruction is to be delayed (block 935).Such a delay may be warranted where, for example, a preceding CPRinstruction has not yet been executed and the delay function assuresthat an ordered execution of intermixed primitive instructions and CPRinstructions is assured. Where no delay is to be incurred or the delayhas been satisfied (block 935), the op-code is executed (block 940).This may included, but is not limited to, executing one of theinstructions included in Table 2 above. It is then determined if anotherwait state is to be implemented prior to a write back of the results ofthe concluded execution (block 945). Such a delay may be warrantedwhere, for example, a preceding CPR instruction has not yet performedits write back. Where no delay is to be incurred or the delay has beensatisfied (block 945), the result of the execution is written back tomemory in an appropriate location (block 950).

Alternatively, where the instruction is sent to the CPR pipe forexecution (block 955), it is decoded (block 960). It is also determinedif execution of the received instruction is to be delayed (block 965).Such a delay may be warranted where, for example, a preceding primitiveinstruction has not yet been executed and the delay function assuresthat an ordered execution of intermixed primitive instructions and CPRinstructions is assured. In some cases, this is highly unlikely and thewait dependency may be eliminated from the CPR pipe. Where no delay isto be incurred or the delay has been satisfied (block 965), the op-codeis executed (block 970). This may included, but is not limited to,executing one of the instructions included in Table 1 above. In thevirus co-processor execution of a common CPR instruction may involveaccessing a portion of a content object from a system memory andcomparing the portion of the content object against a string includedwith the op-code. It is then determined if another wait state is to beimplemented prior to a write back of the results of the concludedexecution (block 975). Such a delay may be warranted where, for example,a preceding primitive instruction has not yet performed its write back.Again, where this is unlikely or impossible, the wait dependency may beeliminated from the CPR pipe. Where no delay is to be incurred or thedelay has been satisfied (block 975), the result of the execution iswritten back to memory in an appropriate location (block 980).

It is determined if another operation is to be completed in relation tothe currently processing virus signature (block 985). Where anotheroperation remains to be executed (block 985), the next operation ispulled (block 915) and the preceding processes are repeated for the newinstruction (blocks 920-980). Alternatively, where no additionaloperations remain to be processed (block 985), the virus signature hasbeen completed and it is determined if another virus signature remainsto be processed (block 990). Where another virus signature remains to beprocessed (block 990), the next virus signature is pulled from theidentified virus signatures (block 910) and the previously describedprocesses are repeated for the new virus signature (blocks 915-985).Alternatively, where no virus signatures remain to be processed (block990), any results from the processing of the virus signature(s) isreported back (block 995).

In some embodiments of the present invention, accessing a content objectfrom the system memory is accomplished using a virtual addressingscheme. Thus, rather than forcing a general purpose processor to writecontent objects to the system memory using physical addresses or forcinga content object to be re-copied to a physical address, a virusco-processor in accordance with some embodiments of the presentinvention may incorporate a virtual address mechanism that allows it toaccess content objects virtually, rather than physically. This mayresult in substantial savings of memory bandwidth and reduce thecomplexity of the interaction between a virus co-processor and a generalpurpose processor.

Turning to FIG. 10, an exemplary virtual addressing scheme that may beused in relation to different embodiments of the present invention isdepicted. In particular, FIG. 10A shows a hierarchy of a page directory1020 and a page-table 1040 utilized when mapping linear addresses 1010to exemplary 4-KByte pages 1050. The entries in page directory 1020point to page tables 1040, and the entries in page tables 1040 point topages 1050 in physical memory. A register 1030 is used to indicate whenan associated general purpose processor has invalidated page directory1020. Where such an invalidation occurs, it is up to the virusco-processor to refresh the page table by accessing the system memory.

FIG. 10B shows a process for using a page directory 1080 to map a linearaddress 1070 to exemplary 4-MByte pages 1090. The entries in pagedirectory 1080 point to 4-MByte pages 1090 in physical memory. Aregister 1095 is used to indicate when an associated general purposeprocessor has invalidated one or more page directory 1080. Where such aninvalidation occurs, it is up to the virus co-processor to refresh thepage table by accessing the system memory.

In operation, a virus co-processor capable of virtual addressing asystem memory stores the most recently used page-directory 1020, 1080and page-table 1040 entries in on-chip caches called translationlookaside buffers or TLBs. In some embodiments of the present invention,the virus co-processor implements virtual addressing only for accessesto content objects from a system memory via a PCI bus. In such cases,instructions or virus signatures may be accessed from a local virussignature memory using physical addresses. Thus, in such cases, thevirus co-processor only includes a TLB for the system memory. Such a TLBmay include reference for both 4-KByte pages 1050 and 4-MByte pages1090. Most paging may be performed using the contents of the TLBs insidethe same task. PCI bus cycles to the page directory and page tables inmemory are performed only when the TLBs do not contain the translationinformation for a requested page. The TLBs may be invalidated when apage-directory or page-table entry is changed between different tasks.

In conclusion, the invention provides novel systems, circuits, devices,methods and arrangements for improved virus protection. While detaileddescriptions of one or more embodiments of the invention have been givenabove, various alternatives, modifications, and equivalents will beapparent to those skilled in the art without varying from the spirit ofthe invention. Therefore, the above description should not be taken aslimiting the scope of the invention, which is defined by the appendedclaims.

What is claimed is:
 1. A method comprising: downloading, by a generalpurpose processor of a network security appliance, a virus signaturefile that includes a plurality of virus signatures capable of detectingand identifying a variety of known viruses; determining, by the generalpurpose processor, whether a virus co-processor is coupled to thegeneral purpose processor; when the virus co-processor is determined tobe coupled to the general purpose processor, then determining, by thegeneral purpose processor, which virus signatures of the plurality virussignatures are supported by the virus co-processor (“CP-supported virussignatures”); causing to be transferred, by the general purposeprocessor, the CP-supported virus signatures to a memory associated withthe virus co-processor; directing, by the general purpose processor, thevirus co-processor to perform a virus scan based on the supported virussignatures.
 2. The method of claim 1, further comprising: marking, bythe general purpose processor, those of the plurality of virussignatures not supported by the virus co-processor as supported by thegeneral purpose processor (“GP-supported virus signatures”); performing,by the general purpose processor, a second virus scan based on theGP-supported virus signatures.
 3. The method of claim 1, wherein saiddetermining which virus signatures of the virus signature file aresupported by the virus co-processor further comprises: determining, bythe general purpose processor, a hardware version of the virusco-processor; determining, by the general purpose processor, theCP-supported virus signatures based on the hardware version of the virusco-processor.
 4. The method of claim 1, further comprising loading theCP-supported virus signatures into the memory associated with the virusco-processor using a direct memory access (DMA) transfer under controlof the general purpose processor; and loading the GP-supported virussignatures into a memory associated with the general purpose processor.5. The method of claim 1, further comprising: receiving, by the generalpurpose processor, a data segment; storing the data segment to a memoryassociated with the general purpose processor; and indicating, by thegeneral purpose processor, a request for the virus scan to the virusco-processor.
 6. The method of claim 5, further comprising: retrieving,by the virus co-processor, the data segment from the memory associatedwith the general purpose processor; retrieving, by the virusco-processor, the CP-supported virus signatures from the memoryassociated with the virus co-processor; executing, by the virusco-processor, one or more of the CP-supported virus signatures againstthe data segment; and communicating a result of said executing to thegeneral purpose processor.
 7. The method of claim 6, wherein saidexecuting one or more of the CP-supported virus signatures against thedata segment comprises executing primitive instructions and ContentPattern Recognition (CPR) instructions of the one or more of theCP-supported virus signatures in an order in which they are maintainedin the memory of the virus co-processor.
 8. The method of claim 5,further comprising: determining, by the general purpose processor, afile type associated with the data segment; and communicating, by thegeneral purpose processor, the file type to the virus co-processor. 9.The method of claim 8, further comprising: retrieving, by the virusco-processor, the file type of the data segment; executing, by the virusco-processor, those of the CP-supported virus signatures that areapplicable to the file type against the data segment.
 10. A networksecurity appliance comprising: a virus co-processor; a non-transitorystorage device having tangibly embodied therein instructionsrepresenting one or more virus scanning routines; and a general purposeprocessor, coupled to the non-transitory storage device and to the virusco-processor, operable to execute the one or more virus scanningroutines to perform a method comprising: downloading, by the generalpurpose processor, a virus signature file that includes a plurality ofvirus signatures capable of detecting and identifying a variety of knownviruses; determining, by the general purpose processor, that the virusco-processor is coupled to the general purpose processor; determining,by the general purpose processor, which virus signatures of theplurality virus signatures are supported by the virus co-processor(“CP-supported virus signatures”); causing to be transferred, by thegeneral purpose processor, the CP-supported virus signatures to a memoryassociated with the virus co-processor; directing, by the generalpurpose processor, the virus co-processor to perform a virus scan basedon the supported virus signatures.
 11. The network security appliance ofclaim 10, wherein the method further comprises: marking, by the generalpurpose processor, those of the plurality of virus signatures notsupported by the virus co-processor as supported by the general purposeprocessor (“GP-supported virus signatures”); performing, by the generalpurpose processor, a second virus scan based on the GP-supported virussignatures.
 12. The network security appliance of claim 10, wherein saiddetermining which virus signatures of the virus signature file aresupported by the virus co-processor further comprises: determining, bythe general purpose processor, a hardware version of the virusco-processor; determining, by the general purpose processor, theCP-supported virus signatures based on the hardware version of the virusco-processor.
 13. The network security appliance of claim 10, whereinthe method further comprising loading the CP-supported virus signaturesinto the memory associated with the virus co-processor using a directmemory access (DMA) transfer under control of the general purposeprocessor; and loading the GP-supported virus signatures into a memoryassociated with the general purpose processor.
 14. The network securityappliance of claim 10, wherein the method further comprises: receiving,by the general purpose processor, a data segment; storing the datasegment to a memory associated with the general purpose processor; andindicating, by the general purpose processor, a request for the virusscan to the virus co-processor.
 15. The network security appliance ofclaim 14, wherein the method further comprises: retrieving, by the virusco-processor, the data segment from the memory associated with thegeneral purpose processor; retrieving, by the virus co-processor, theCP-supported virus signatures from the memory associated with the virusco-processor; executing, by the virus co-processor, one or more of theCP-supported virus signatures against the data segment; andcommunicating a result of said executing to the general purposeprocessor.
 16. The network security appliance of claim 15, wherein saidexecuting one or more of the CP-supported virus signatures against thedata segment comprises executing primitive instructions and ContentPattern Recognition (CPR) instructions of the one or more of theCP-supported virus signatures in an order in which they are maintainedin the memory of the virus co-processor.
 17. The network securityappliance of claim 14, wherein the method further comprises:determining, by the general purpose processor, a file type associatedwith the data segment; and communicating, by the general purposeprocessor, the file type to the virus co-processor.
 18. The networksecurity appliance of claim 17, wherein the method further comprises:retrieving, by the virus co-processor, the file type of the datasegment; executing, by the virus co-processor, those of the CP-supportedvirus signatures that are applicable to the file type against the datasegment.